fix: 收窄 Artificer pika 配置范围

This commit is contained in:
Codex
2026-07-12 17:57:44 +02:00
parent 18017306b9
commit acb9674454
14 changed files with 50 additions and 874 deletions
+1 -30
View File
@@ -427,45 +427,16 @@ export function readYamlInputFromArgs(args: string[]): string {
export async function aipodRenderInputFromArgs(args: string[], trailingPromptStart: number, overrides: Record<string, unknown> = {}): Promise<Record<string, unknown>> {
const input = await optionalJsonBody(args);
assertAipodRenderProviderAuthority(args, input);
const prompt = optionalPromptFromArgs(args, args.length);
const prompt = optionalPromptFromArgs(args, trailingPromptStart);
if (prompt !== null) input.prompt = prompt;
copyAgentRunOptions(args, input, ["tenant-id", "project-id", "queue", "node", "lane", "title", "provider-id", "idempotency-key", "session-id", "model", "reasoning-effort"]);
const priority = agentRunOption(args, "priority");
if (priority) input.priority = Number(priority);
const workspaceRef = jsonObjectOption(args, "workspace-json");
if (workspaceRef !== null) input.workspaceRef = workspaceRef;
void trailingPromptStart;
return { ...input, ...overrides };
}
function assertAipodRenderProviderAuthority(args: string[], input: Record<string, unknown>): void {
const forbiddenFlags = ["profile", "backend-profile", "execution-policy-json"]
.filter((flag) => agentRunHasFlag(args, flag))
.map((flag) => `--${flag}`);
if (forbiddenFlags.length > 0) {
throw new AgentRunRestError(
"validation-failed",
`AipodSpec owns backendProfile, provider credential SecretRef, and executionPolicy; remove ${forbiddenFlags.join(", ")} and use only --model/--reasoning-effort for task-level model selection`,
);
}
const forbiddenTopLevel = ["profile", "backendProfile", "modelConfig", "executionPolicy", "providerCredentials", "providerCredential", "secretRef"]
.filter((key) => Object.hasOwn(input, key));
const payload = record(input.payload);
const forbiddenPayload = ["model", "reasoningEffort", "modelConfig", "backendProfile", "executionPolicy", "providerCredentials", "providerCredential", "secretRef"]
.filter((key) => Object.hasOwn(payload, key));
if (forbiddenTopLevel.length > 0 || forbiddenPayload.length > 0) {
const fields = [
...forbiddenTopLevel,
...forbiddenPayload.map((key) => `payload.${key}`),
];
throw new AgentRunRestError(
"validation-failed",
`Aipod render input cannot override provider authority or place model overrides in payload: ${fields.join(", ")}; use top-level model/reasoningEffort`,
);
}
}
export function readPromptFromArgs(args: string[], trailingStart: number): string {
const prompt = optionalPromptFromArgs(args, trailingStart);
if (prompt === null) throw new AgentRunRestError("validation-failed", "prompt is required; use --prompt-stdin, --prompt-file, --prompt, or a trailing prompt");